There is no NIST AI security framework

Practitioners, vendors, and policymakers increasingly treat “the NIST AI security framework” as if it named a single control baseline. It does not.

NIST has published a family of voluntary AI documents since 2023. The phrase is used for at least three different things: the Artificial Intelligence Risk Management Framework (AI RMF) itself; the later Cybersecurity Framework Profile for Artificial Intelligence (NIST IR 8596); and, more loosely, the union of those documents with adversarial-machine-learning guidance and ordinary cybersecurity controls. Conflating them produces two failure modes. Teams that wanted a security program implement only governance workshops. Teams that wanted trustworthy AI implement only model-hardening checklists.

This essay is a tour of a mapping paper. We read the public NIST corpus as of August 2026. We do not evaluate models, and we do not claim that any product implements the AI RMF.

Three observations

The suite is the framework. AI RMF 1.0 (NIST AI 100-1) shipped in January 2023 with a Playbook, a Roadmap, a detailed account of trustworthy-AI characteristics, and a community catalog via the Trustworthy and Responsible AI Resource Center. Treating AI 100-1 as the entire program understates what NIST published in the first quarter of 2023.

Security is a characteristic, not the frame. NIST lists seven trustworthy-AI characteristics. Secure and resilient is one row in that list. The four functions — Govern, Map, Measure, Manage — are how an organization pursues all seven, including the tensions among them.

Cybersecurity instruments plug in; they do not replace. CSF 2.0, the draft Cyber AI Profile, AI 100-2, AI 600-1, and SP 800-53 deepen cybersecurity and generative-AI practice. NIST’s own commentary is that CSF 2.0, the AI RMF, and the Cyber AI Profile are meant to be used together.

The original suite

NIST’s January 2023 launch was a package, not a single file:

Govern is cross-cutting. Map, Measure, and Manage run as a loop on a given AI system. The Core describes outcomes, not tools. “MEASURE 2: AI systems are evaluated for trustworthy characteristics” does not name a red-team vendor or an adversarial-robustness metric. Those choices belong in the Playbook, in an organizational profile, or in a complement such as AI 100-2.

Security is one of seven

Trustworthy AI systems are, in combination: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed.

Secure and resilient overlaps the classical CIA triad and CSF outcomes. It does not, by itself, include whether the model’s stated objective matches the deployer’s values, whether refusals are adequate, whether explanations are faithful, or whether evaluations are statistically valid. Adversarial machine learning sits on the boundary — which is why NIST wrote a dedicated taxonomy rather than folding AML entirely into CSF.

A security-only reading of the four functions still has content: who owns model risk versus application security; what the AI system actually is (model, prompts, tools, retrieval, humans); what tests exist for jailbreaks, injection, exfiltration, and poisoning; and what residual risk remains after mitigations — including harms that will never appear in a SIEM.

Which document answers which question

The practical question is not which document is “the” framework. It is which document answers which question:

1. What outcomes do we owe? → AI RMF 1.0 + profile (AI 600-1 or sector)
2. How might we pursue them? → Playbook + AIRC examples
3. What are the cyber outcomes? → CSF 2.0 + Cyber AI Profile (IR 8596)
4. What can happen to the model? → AI 100-2 (+ ATLAS)
5. Which controls instantiate that? → SP 800-53 / overlay / ISO 27001

Skipping a row is common. Claiming the skipped row was covered is the usual error.

A worked example: an agentic chat system

Consider a hosted assistant that retrieves private documents, calls tools, and acts over multiple turns.

Map. The system is not “the model.” It is the model, the system prompt, retrieved corpora, tool APIs, session memory, evaluators, and human operators. AI 600-1’s generative-AI risk list is in scope.

Govern. Separate owners for application security, model and prompt change control, safety policy, and vendor models. Third-party Govern applies to foundation-model APIs the same way it applies to SaaS.

Measure. AI 100-2 misuse and privacy classes cover jailbreaks, prompt injection via retrieved documents, and data exfiltration through tools. They do not cover confabulation that harms a user without an attacker. A red-team report that only counts attack success rate is incomplete Measure relative to AI 600-1.

Manage. Incident types include classical breaches and harmful completed tool actions. Recovery may mean rolling back a prompt or a model, not only rotating credentials.

Four failure modes

We observe four recurring category errors in public claims:

• PDF compliance. Treating a completed Playbook spreadsheet as implementation of MEASURE 2.
• Security synecdoche. Equating AI RMF implementation with an adversarial robustness eval.
• Ethics synecdoche. Equating AI RMF implementation with a fairness dashboard and no incident path.
• Certification theatre. Advertising “NIST AI RMF certified” despite NIST offering no such certification for 1.0.

The last is the most misleading. ISO/IEC 42001 is the certifiable AI management system. The AI RMF is a voluntary outcomes framework that can be aligned with that system — never certified to it.

Why this map

Used together, these documents are coherent. Used as synonyms, they produce programs that are either security with ethics vocabulary, or ethics with no incident path. The cheapest correction is linguistic: say which document answers which question, and stop claiming the rest.

AI RMF 1.0 is being revised under the White House AI Action Plan; the Playbook will follow that revision. Readers should treat this as a map of the 1.0-era suite plus the complements published through mid-2026 — not as a freeze of the 2.0 text.

For full details, tables, and the complete usage procedure, read the paper.

@online{violet2026nistairmf,
  author = {Haigh, John},
  title = {The NIST AI Risk Management Framework: Mapping the Core Suite to Security Practice},
  date = {2026-09-12},
  year = {2026},
  url = {https://www.violetai.ca/en/research/nist-ai-rmf/paper},
}